The Phoca Commander extension for Joomla versions 1.0.0 to 6.1.3 contains a CWE-22 path traversal vulnerability. This occurs due to insufficient validation of file paths in the file upload functionality, enabling an attacker with high privileges to access or manipulate files outside the designated directory. The vulnerability is network exploitable without user interaction but requires high privileges. No vendor advisory or patch information is currently provided.

An attacker with high privileges can exploit this vulnerability to traverse directories beyond the intended restricted directory during file uploads. This could potentially lead to unauthorized access or modification of files on the affected system. The vulnerability does not require user interaction and is exploitable over the network, increasing its risk profile. However, the impact is limited by the requirement for high privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable extension to untrusted networks or users with elevated privileges.